Alan Lacerda

**Name of the Vulnerable Software and Affected Versions** ShareMouse version 5.0.43 **Description** ShareMouse 5.0.43 contains an unquoted service path vulnerability. This allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the insecure service path configuration by placing malicious executables in specific system directories to gain elevated access during service startup. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MK-Auth version 23.01K4.9 **Description** An arbitrary file upload vulnerability in the Virtual Disk of MK-Auth allows attackers to execute arbitrary code via uploading a crafted .htaccess file. **Recommendations** For MK-Auth version 23.01K4.9, consider restricting access to the Virtual Disk to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the Virtual Disk feature to upload files, especially .htaccess files, until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MK-AUTH versions through 19.01 K4.9 **Description** The issue allows for XSS via the "admin/logs ajax.php" endpoint, specifically through the `tipo` parameter. An attacker can exploit this to read the `centralmka2` (session token) cookie, which is not set to HTTPOnly. **Recommendations** For MK-AUTH versions through 19.01 K4.9, consider restricting access to the "admin/logs ajax.php" endpoint until a patch is available. As a temporary workaround, avoid using the `tipo` parameter in the affected endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** MK-AUTH versions through 19.01 K4.9 **Description** The issue allows for Cross-Site Request Forgery (CSRF) attacks, which can lead to unauthorized password changes. This is possible via the "central/executar central.php?acao=altsenha princ" URI. **Recommendations** For MK-AUTH versions through 19.01 K4.9, consider disabling access to the central/executar central.php?acao=altsenha princ URI as a temporary workaround until a patch is available. Restricting the functionality related to password changes can also help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MK-AUTH versions through 19.01 K4.9 **Description** The issue allows remote attackers to obtain sensitive information, such as a CPF number, by modifying the `titulo` (also known as invoice number) value in the "central/recibo.php" URI. **Recommendations** For MK-AUTH versions through 19.01 K4.9, as a temporary workaround, consider restricting access to the "central/recibo.php" URI until a patch is available. Avoid using modified `titulo` values in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.